Articles by "Digital Forensics"
Showing posts with label Digital Forensics. Show all posts

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

Forensic Image Analysis is the application of image science and domain expertise to interpret the content of an image and/or the image itself in legal matters. Major subdisciplines of Forensic Image Analysis with law enforcement applications include: Photogrammetry, Photographic Comparison, Content Analysis, and Image Authentication." (Scientific Working Group on Imaging Technologies)


It is not meant as an automatic tool that decide if an image is forged or not (that tool probably will never exist...), but as a companion in experimenting with various algorithms found in the latest research papers and workshops.

While many commercial solutions have high retail prices and often reserved to law enforcement and government agencies only, this toolset aims to be a both an extensible framework and a starting point for anyone interested in making experiments in this particular application of digital signal processing.

Modern Qt-based GUI with multiple tool window management

Support for many formats (JPEG, PNG, TIFF, BMP, WebP, PGM, PFM, GIF)

Highly responsive image viewer with real-time pan and zoom

Many state-of-the-art algorithms to try out interactively

Export both visual and textual results of the analysis

Extensive online help with explanations and tutorials


General

  • Original Image: display the unaltered reference image for visual inspection
  • File Digest: retrieve physical file information, crypto and perceptual hashes
  • Hex Editor: open an external hexadecimal editor to show and edit raw bytes
  • Similar Search: browse online search services to find visually similar images


Metadata

  • Header Structure: dump the file header structure and display an interactive view
  • EXIF Full Dump: scan through file metadata and gather all available information
  • Thumbnail Analysis: extract optional embedded thumbnail and compare with original
  • Geolocation Data: retrieve optional geolocation data and show it on a world map


Inspection

  • Enhancing Magnifier: magnifying glass with enhancements for better identifying forgeries
  • Channel Histogram: display single color channels or RGB composite interactive histogram
  • Global Adjustments: apply standard image adjustments (brightness, hue, saturation, ...)
  • Reference Comparison: open a synchronized double view for comparison with another picture


Detail

  • Luminance Gradient: analyze horizontal/vertical brightness variations across the image
  • Echo Edge Filter: use derivative filters to reveal artificial out-of-focus regions
  • Wavelet Threshold: reconstruct image with different wavelet coefficient thresholds
  • Frequency Split: split image luminance into high and low frequency components


Colors

  • RGB/HSV Plots: display interactive 2D and 3D plots of RGB and HSV pixel values
  • Space Conversion: convert RGB channels into HSV/YCbCr/Lab/Luv/CMYK/Gray spaces
  • PCA Projection: use color PCA to project pixel onto most salient components
  • Pixel Statistics: compute minimum/maximum/average RGB values for every pixel


Noise

  • Noise Separation: estimate and extract different kind of image noise components
  • Min/Max Deviation: highlight pixels deviating from block-based min/max statistics
  • Bit Planes Values: show individual bit planes to find inconsistent noise patterns
  • PRNU Identification: exploit sensor pattern noise introduced by different cameras


JPEG

  • Quality Estimation: extract quantization tables and estimate last saved JPEG quality
  • Error Level Analysis: show pixel-level difference against fixed compression levels
  • Multiple Compression: use a machine learning model to detect multiple compression
  • JPEG Ghost Maps: highlight traces of different compression levels in difference images


Tampering

  • Contrast Enhancement: analyze color distribution to detect contrast enhancements
  • Copy-Move Forgery: use invariant feature descriptors for cloned area detection
  • Composite Splicing: exploit DCT statistics for automatic splicing zone detection
  • Image Resampling: estimate 2D pixel interpolation for detecting resampling traces


Various

  • Median Filtering: detect processing traces left by nonlinear median filtering
  • Illuminant Map: estimate scene local light direction on estimated 3D surfaces
  • Dead/Hot Pixels: detect and fix dead/hot pixels caused by sensor imperfections
  • Stereogram Decoder: decode 3D images concealed in crossed-eye autostereograms



Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

OpenStego is a steganography application that provides two functionalities:

Data Masking: It can hide any data within an image file.

Watermarking: Watermarking image files with an invisible signature. It can be used to detect unauthorized file copying.

It supports password-based encryption of data for additional layer of security. AES 128 and AES 256 algorithms are supported.

It uses a plugin based architecture, where various plugins can be created for different kind of Steganographic / Watermarking algorithms. 

Currently, it supports two plugins - RandomLSB (Randomized LSB) for data hiding and Dugad's algorithm for watermarking, but new plugins can be easily created for other algorithms. Plugins can also be easily added for other type of cover files like Audio files.




Download OpenStego

Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

Performing memory analysis in incident response investigations can be tedious and challenging because of the lack of commercial options for processing memory samples, no all-in-one open-source tools to process samples, and a shortage of the knowledge and skill to do so. 

Recognizing this, CrowdStrike Services created SuperMem, an open-source Windows memory processing script that helps investigators consistently and quickly process memory samples in their investigations.



SuperMem, or “winSuperMem.py,” is a Python script that will parse Windows memory samples in a consistent, quick and selective way. It is backed by a triage-type methodology that makes the tool easy to use and therefore more accessible to forensic analysts. The triage-type methodology consists of three types: Quick, Full and Comprehensive. 


SuperMem currently consists of one Python script, “winSuperMem.py,” that is meant for processing Windows memory images. By running SuperMem with a specified triage type (Quick, Full or Comprehensive), the script will process the memory sample in several ways.


Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

Malwoverview is a first response tool used for downloading and screening malware samples, suspicious URLs, IP address, domains. Malwoverview offers threat hunting information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, ThreatCrowd, Valhalla and it is able to scan Android devices against VT and HA.



Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
Malware Analysis - Static, Dynamic and Code Analysis



Video
Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
Course is being offered by Department of Electrical Engineering and Computing Systems, College of Engineering and Applied Science, University of Cincinnati

 Course covers malware concepts, malware analysis, and black-box reverse engineering techniques. The target audience is focused on computer science graduate students or undergraduate seniors without prior cyber security or malware experience. It is intended to introduce the students to types of malware, common attack recipes, some tools, and a wide array of malware analysis techniques.




Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
REMnux is a free Linux toolkit for assisting malware analysts with reverse-engineering malicious software. It strives to make it easier for forensic investigators and incident responders to start using the variety of freely-available tools that can examine malware, yet might be difficult to locate or set up.

The heart of the project is the REMnux Linux distribution based on Ubuntu. This lightweight distro incorporates many tools for analyzing Windows and Linux malware, examining browser-based threats such as obfuscated JavaScript, exploring suspicious document files and taking apart other malicious artifacts. Investigators can also use the distro to intercept suspicious network traffic in an isolated lab when performing behavioral malware analysis.

The REMnux distribution includes many free tools useful for examining malicious software. These utilities are set up and tested to make it easier for you to perform malware analysis tasks without needing to figure out how to install them. The tools installed on REMnux can help you:
    Examine browser malware
    Analyze malicious document files
    Extract and decode suspicious artifacts
    Handle laboratory network interactions
    Review multiple malware samples
    Examine properties and contents of suspicious files
    Investigate Linux and Windows malware
    Perform memory forensics




Download REMnux Distro

Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
forpix is a forensic program for identifying similar images that are no longer identical due to image manipulation. Hereinafter I will describe the technical background for the basic understanding of the need for such a program and how it works.

The program runs on all Java-capable machines with a 32 bit Java-VM. Just use the Java flag "-jar -Xmx1024m forpix.jar" in the command prompt.

To perform a comparison following steps are necessary. The execution of the steps are very simple in practice.

  •     Creating an image database.
  •     Analyzing images of a seized media and import the images and hash values into the image database in one step.
  •     Analyzing a reference image and performing an automated image comparison in one step.
  •     Select similar images to create a report.



Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.

The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the run time state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.





Continue reading
Subscribe to: Posts (Atom)